Merge branch 'master' into cmdguard2

Author: adity1raut

.github/workflows/codeql-analysis.yml

@@ -46,7 +46,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@19b2f06db2b6f5108140aeb04014ef02b648f789 # v3.29.5
+      uses: github/codeql-action/init@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3.29.5
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -66,4 +66,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@19b2f06db2b6f5108140aeb04014ef02b648f789 # v3.29.5
+      uses: github/codeql-action/analyze@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3.29.5

.github/workflows/pr-quota-limit.yml

@@ -0,0 +1,106 @@
+name: PR Quota Limit
+
+on:
+  pull_request:
+    types: [opened, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  check-pr-quota:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Check PR quota
+        // Use action version v7.0.1
+        uses: actions/github-script@60a0d8304218317a38b4124020f343a0d555a1eb
+        with:
+          script: |
+            try {
+              const prAuthor = context.payload.pull_request.user.login;
+              const currentPRNumber = context.payload.pull_request.number;
+
+              console.log(`Checking PR quota for user: ${prAuthor}`);
+              console.log(`Current PR number: ${currentPRNumber}`);
+
+              // Get all open PRs with pagination support
+              let allPRs = [];
+              let page = 1;
+              let hasMorePages = true;
+
+              while (hasMorePages) {
+                const { data: prs } = await github.rest.pulls.list({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  state: 'open',
+                  per_page: 100,
+                  page: page
+                });
+
+                allPRs = allPRs.concat(prs);
+
+                // If we got less than 100 PRs, we've reached the last page
+                if (prs.length < 100) {
+                  hasMorePages = false;
+                } else {
+                  page++;
+                }
+              }
+
+              console.log(`Total open PRs in repository: ${allPRs.length}`);
+
+              // Filter PRs by the same author
+              const userPRs = allPRs.filter(pr => pr.user.login === prAuthor);
+              const openCount = userPRs.length;
+
+              console.log(`User ${prAuthor} has ${openCount} open PR(s)`);
+
+              // Check if exceeds quota (15 PRs max)
+              const maxPRs = 15;
+              if (openCount > maxPRs) {
+                const currentStatus = `${openCount}/${maxPRs}`;
+
+                const message = `Hi, @${prAuthor}, Thanks for your contribution! To ensure quality reviews, we limit how many concurrent open PRs contributors can open. This pull request will be temporarily closed (Current status: ${currentStatus} open). We encourage you to submit a new PR once the quota policy permits future contributions.`;
+
+                console.log(`Quota exceeded! Closing PR #${currentPRNumber}`);
+                console.log(`User has ${openCount} open PRs, which exceeds the limit of ${maxPRs}`);
+                console.log(`Message: ${message}`);
+
+                // Add comment to the PR
+                try {
+                  await github.rest.issues.createComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: currentPRNumber,
+                    body: message
+                  });
+                  console.log('Comment added successfully');
+                } catch (commentError) {
+                  console.error('Failed to add comment:', commentError.message);
+                }
+
+                // Close the PR
+                try {
+                  await github.rest.pulls.update({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    pull_number: currentPRNumber,
+                    state: 'closed'
+                  });
+                  console.log(`PR #${currentPRNumber} has been closed due to quota limit.`);
+                } catch (closeError) {
+                  console.error('Failed to close PR:', closeError.message);
+                  throw closeError; // Re-throw to fail the workflow
+                }
+              } else {
+                const availableSlots = maxPRs - openCount;
+                console.log(`Quota check passed. User has ${availableSlots} slot(s) available.`);
+              }
+            } catch (error) {
+              console.error('Error in PR quota check:', error.message);
+              throw error; // Re-throw to fail the workflow
+            }

.github/workflows/sonarcloud.yaml

@@ -51,6 +51,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@19b2f06db2b6f5108140aeb04014ef02b648f789 # v2.22.11
+        uses: github/codeql-action/upload-sarif@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v2.22.11
         with:
           sarif_file: results.sarif

.gitignore

@@ -24,6 +24,7 @@ bin
 *.swo
 *~
 .vscode
+.qoder
 
 **/*.tgz
 **/.DS_Store

CONTRIBUTING.md

@@ -104,6 +104,9 @@ Go to the "Pull requests" tab page under your repository and Click the "New Pull
 
 To help reviewers better get your purpose, PR title should be descriptive enough but not too long. It's also recommended that you follow the [PR template](.github/PULL_REQUEST_TEMPLATE.md) as your PR description.
 
+#### PR Quota Policy
+To maintain code quality and avoid conflicts, we enforce a limit on the number of open pull requests per contributor. Each contributor can have a **maximum of 15 open pull requests** at any given time. If you attempt to open or reopen a pull request when you already have 15 open PRs, the pull request will be automatically closed with a notification message. Please wait for some of your existing PRs to be merged or closed before submitting or reopening additional ones.
+
 ### Tracking Your PR
 Once you've submitted the PR to the Fluid project, your PR will be reviewed. Please keep tracking the status of your PR, make responses to the reviewers' comments and update your changes if needed to make your PR get accepted.
 

ROADMAP.md

@@ -1,62 +1,78 @@
 # Fluid Roadmap
 
-## Fluid 2025 Roadmap
-
-### **1. Data Anyway**  
-**Objective**: Enable fluid data access **regardless of infrastructure constraints** (e.g., storage types, runtime environments) without developing controller code.
-
-- **Unified Cache Runtime Framework**  
-  - Enable integration of new cache runtimes(e.g., Cubefs, DragonFly) via a **generic Cache Runtime interface** with minimal code changes.    
-  - Standardize APIs for cache engine compatibility (e.g., Alluxio, Vineyard, JuiceFS).  
-- **Adaptive Data Access**:  
-  - Data Access Mode based on Scheduler's Decsion:  
-    - *Shared-Kernel Nodes* → Use CSI plugins for direct mounting.  
-    - *Kata Containers* → Switch to sidecar-based container. 
-- **ThinRuntime Productization**:  
-  - Improve stability and performance for large-scale deployments.  
-  - Minimum container permission (remove the privileged permission of FUSE Pod)
-
-
-### **2. Data Anywhere**  
-**Objective**: Achieve **cross-region, cross-cluster, and cross-platform** data mobility and accessibility.  
-
-- **Multi-Cluster Dataset Unified Management**  
-  - **Global Dataset**: Create datasets pointing to the same data source across clusters.  
-  - **Queue Integration**: Orchestrate dependencies between data preparation and task scheduling.  
-  - **Persistent Data Mirroring**  
-    - **Region-Aware Replication**: Automatically mirror datasets across clouds/regions.  
-    - **Consistency Guarantees**: Support both eventual and strong consistency models.  
-
-- **Efficient Data Prewarming & Migration**  
-  - **Distributed Prewarming**: Maximize bandwidth utilization for fast data loading.  
-  - **Throttling Control**: Limit bandwidth usage during prewarming to avoid saturation.  
-  - **Rsync Optimization**: Improve cross-region sync efficiency.  
-
-- **Elastic Caching & Scheduling**:  
-  - **Disk-Aware Scheduling**: Optimize workload placement based on disk capacity, utilization, and locality.  
-  - **Intelligent Scaling**:  
-    - Recommend underutilized Pods for scaling (cost/performance-aware).  
-    - Ensure cache engines adapt to dynamic throughput post-scaling.  
-  - **Cloud-Agnostic Recovery**: Rebuild caches across regions using cloud disk snapshots.  
-
-- **Observability-Driven Optimization**  
-  - **Pattern Recognition**: Analyze data access patterns to auto-inject acceleration components (e.g., caching, prefetching).  
-  - **Idle Dataset Detection**: Identify unused datasets via reference counting and access history.  
-
-- **Application-Side Acceleration**  
-  - **Transparent Prefetching**:  
-    - Inject sidecar containers to prefetch data dynamically (e.g., Alluxio/Fluid Runtime).  
-    - Auto-adjust prefetch strategies (block size, concurrency) based on access patterns.  
-  - **Dynamic SDK Injection**: Attach acceleration SDKs to Pods via Fluid Admission Controller (no base image modification).  
-
-
-### **3. Data Anytime**  
-**Core Goal**: Ensure **real-time, adaptive, and intelligent** data availability for workloads.  
-
-- **Temporal Workflows with Kueue**:  
-  - Trigger ML jobs (TFJob, PyTorchJob) **after prewarming completes**.  
-  - Automate post-job cleanup (data migration/cache eviction).  
-- **Dynamic Volume Mounting**:  
-  - Support dynamic volume mounting capabilities for multi-cloud/hybrid-cloud scenarios.  
-  - Enable dyanmic data mount operations in Python SDK. 
+## Fluid 2026 Roadmap
 
+### 1. Data Anyway
+
+> **Objective:** Enable fluid data access **regardless of infrastructure constraints** (e.g., storage types, runtime environments) without developing controller code.
+
+#### Generic Cache Runtime
+
+- **Pluggable Architecture:** Standardized Cache Runtime Interface for rapid integration of new engines (CubeFS, Dragonfly, Vineyard) with minimal boilerplate.
+- **Orchestration Based on AdvancedStatefulSet:** Migrate from StatefulSet to AdvancedStatefulSet for fine-grained Pod lifecycle management, ordered rollout, and enhanced failover capabilities.
+
+#### Runtime Dynamic Configuration
+
+- **Zero-Downtime Tuning:** Adjust cache replicas, storage media tiers (SSD/HDD/RAM), and eviction policies without Dataset reconstruction or workload restart.
+- **Hot Parameter Swapping:** Runtime modification of cache engine configurations (e.g., Alluxio thread pool, Jindo worker threads) for traffic spike handling.
+
+#### API Upgrade to `v1alpha2`
+
+- Standardized Conditions, `ObservedGeneration`, and phase transition semantics for improved GitOps and tooling compatibility.
+- Conversion webhook support for seamless `v1alpha1` → `v1alpha2` migration.
+
+#### Validation Webhook
+
+- Admission-time CRD validation with auto-correction suggestions to prevent misconfigurations.
+- Policy enforcement for resource quotas and security constraints.
+
+#### ThinRuntime Productization
+
+- Production-ready stability for large-scale deployments with **minimum container privileges** (eliminate privileged FUSE Pod requirements).
+
+---
+
+### 2. Data Anywhere
+
+> **Objective:** Achieve **cross-region, cross-cluster, and cross-platform** data mobility and accessibility.
+
+#### LLM KV Cache Orchestration
+
+- **Disaggregated KV Cache:** Externalize vLLM/SGLang KV Cache to Fluid-managed distributed storage, enabling 10x+ throughput improvement for long-context inference.
+- **Cross-Pod Cache Sharing:** Live migration of KV Cache between inference instances for preemptive scheduling and spot instance tolerance.
+- **Mooncake Integration:** Official partnership for high-performance KV Cache backend with RDMA acceleration.
+
+#### Efficient Data Prewarming & Migration
+
+- **Distributed Prewarming:** Maximize bandwidth utilization for fast data loading.
+- **Throttling Control:** Limit bandwidth usage during prewarming to avoid saturation.
+- **Rsync Optimization:** Improve cross-region sync efficiency.
+
+#### JindoRuntime High Availability
+
+- **Master Pod Crash Recovery:** Automatic re-setup and state reconstruction after cache master failure without data loss.
+- **Metadata Persistence:** WAL-based metadata recovery for rapid failover.
+
+#### Observability-Driven Optimization
+
+- **Access Pattern Recognition:** ML-based analysis to auto-inject acceleration strategies (prefetching, block size optimization).
+- **Dataset Garbage Collection:** Idle dataset detection via reference counting and access history analysis.
+
+---
+
+### 3. Data Anytime
+
+> **Objective:** Ensure **real-time, adaptive, and intelligent** data availability for workloads.
+
+#### Temporal Workflow Integration
+
+- **Kueue-Driven Pipelines:** Trigger training/inference jobs automatically upon DataLoad completion; automate post-job cache eviction and data migration.
+- **Event-Driven Policies:** Flexible metadata synchronization triggered by workload lifecycle events.
+
+#### Developer Experience
+
+- **Fluid kubectl Plugin:** Native CLI extension (`kubectl fluid`) for:
+  - Dataset status inspection and health diagnostics
+  - On-demand prewarming triggering (`kubectl fluid warmup`)
+  - Cache performance profiling and bottleneck analysis
+  - Runtime configuration hot-updates

addons/3fs/dev-guide/Dockerfile

@@ -6,6 +6,8 @@ ARG FOUNDATIONDB_TAG=7.3.59
 ARG FOUNDATIONDB_VERSION=${FOUNDATIONDB_TAG}-1
 ARG LIBFUSE_TAG=fuse-3.16.1
 ARG LIBFUSE_VERSION=3.16.1
+ARG RUSTUP_VERSION=1.27.1
+ARG RUSTUP_INIT_SHA256=f39939f3c83a31eda563840394548455a095842de8467556748c55a9346a4959
 
 # Install system dependencies and build tools
 RUN apt update && \
@@ -22,8 +24,8 @@ RUN apt update && \
     rm -rf /var/lib/apt/lists/* apache-arrow-apt-source-latest-$(lsb_release --codename --short).deb
 
 # Install Rust
-RUN wget -O rustup-init "https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rustup-init" && \
-    echo "f39939f3c83a31eda563840394548455a095842de8467556748c55a9346a4959 *rustup-init" | sha256sum -c - && \
+RUN wget -O rustup-init "https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/x86_64-unknown-linux-gnu/rustup-init" && \
+    echo "${RUSTUP_INIT_SHA256} *rustup-init" | sha256sum -c - && \
     chmod +x rustup-init && \
     ./rustup-init -y --no-modify-path --default-toolchain 1.90.0 && \
     rm rustup-init

addons/glusterfs/docker/entrypoint.py

@@ -1,12 +1,36 @@
 import json
 import os
+import re
 import subprocess
 
 obj = json.load(open("/etc/fluid/config/config.json"))
 
 mount_point = obj["mounts"][0]["mountPoint"]
 target_path = obj["targetPath"]
 
+# Normalize first to resolve redundant separators, '.' and '..' components
+target_path = os.path.normpath(target_path)
+
+# Validate that the normalized path is an absolute POSIX path
+if not os.path.isabs(target_path) or not target_path.startswith('/'):
+    print(f"Error: target_path must be absolute: {target_path}")
+    exit(1)
+
+# Safety check: ensure no '..' components remain after normalization
+if '..' in target_path.split('/'):
+    print(f"Error: Path traversal using '..' is not allowed in target_path: {target_path}")
+    exit(1)
+
+# Validate that the path contains only safe characters
+if not re.match(r'^[/a-zA-Z0-9._-]+$', target_path):
+    print(f"Error: target_path contains invalid characters: {target_path}")
+    exit(1)
+
+# Prevent mounting on the root directory
+if target_path == '/':
+    print("Error: target_path resolves to the root directory '/' and is not allowed.")
+    exit(1)
+
 os.makedirs(target_path, exist_ok=True)
 
 if len(mount_point.split(":")) != 2: